Reported by 1 outlet

Timeline

1. original reporting

   SimpleHelp CVE-2026-48558 — Critical Flaw Allows Unauthenticated Technician Account Creation

   bleepingcomputer.com · 120d ago · June 16th, 2026

   A critical flaw in SimpleHelp remote management software (versions ≤5.5.15, 6.0 pre-release) allows unauthenticated attackers to create privileged technician accounts on servers using OIDC authentication. The vulnerability in identity assertion validation enables bypassing MFA and gaining remote access to managed endpoints, with script execution capabilities. ~14,000 SimpleHelp servers are internet-exposed, with ~7.2% using OIDC. Patched in versions 5.5.16 and 6.0RC2 (June 9).

   ---

2. update from bleepingcomputer.com

   Critical SimpleHelp Vulnerability (CVE-2026-48558) Exploited to Deploy Djinn Stealer — New Cross-Platform Malware Targeting AI Developer Credentials

   bleepingcomputer.com · 106d ago · June 30th, 2026

   Attackers are actively exploiting CVE-2026-48558, a critical authentication bypass in the SimpleHelp remote monitoring and management platform (used primarily by MSPs and IT departments), to deploy TaskWeaver (a JavaScript-based malware loader) and Djinn Stealer, a previously undocumented cross-platform information stealer targeting Windows, macOS, and Linux. Horizon3.ai disclosed the flaw earlier this month, noting ~1,000 internet-exposed SimpleHelp servers were running vulnerable configurations using OpenID Connect (OIDC). Blackpoint's MDR team investigated an incident where the attacker established an authenticated technician session on an internet-facing SimpleHelp server before deploying the malware chain. Djinn Stealer specifically targets:

   • AI development credentials — MCP configuration files for Claude, Gemini, Codex, Cline, OpenCode, and Kilo

   • Cloud/infrastructure credentials — AWS, GCP, Azure, Docker, Terraform, Pulumi, HashiCorp Vault

   • Git/package manager credentials — SSH keys, GitHub CLI tokens, npm/pip/Cargo/Maven credentials

   • Cryptocurrency wallets — Bitcoin, Ethereum, Monero, Exodus, Atomic Wallet, Electrum

   Data is packed into a TAR archive, GZIP-compressed, and AES-256-GCM encrypted with an RSA-2048 key embedded in TaskWeaver before exfiltration. Recommended action: Update SimpleHelp instances immediately. Invalidate all existing technician sessions. Rotate any credentials exposed through compromised servers.